What's the right UX for an expired certificate?
emilymstark.com
What's the right UX for an expired certificate?
1–10 of 105 posts
Re: What's the right UX for an expired certificate?
#2Browsers could add the less severe warning before the certificate expires, for example 3 days before it expires have a "this certificate is about to expire, are you sure you want to continue?" warning. That would maintain the security guarantees around expiration while still getting the attention of users/administrators.
Re: What's the right UX for an expired certificate?
#3[deleted]
Re: What's the right UX for an expired certificate?
#4Browsers could add the less severe warning before the certificate expires, for example 3 days before it expires have a "this certificate is about to expire, are you sure you want to continue?" warning. That would maintain the security guarantees around expiration while still getting the attention of users/administrators.
Alarm all the users to notify one person? Doesn't seem so good to me.
Re: What's the right UX for an expired certificate?
#5Really interesting point. I've worked with CAs and TLS certs for 20+ years and this never even occurred to me.
The UX is horrible, considering how many regular non-tech people an expired cert can affect.
Imho the browser should continue showing its big full-page warning, but there should still be a way to proceed to the site.
What if a cert expires on a life-saving service? And now the user can't even reach the site just because the time is wrong.
Re: What's the right UX for an expired certificate?
#6Browsers could add the less severe warning before the certificate expires, for example 3 days before it expires have a "this certificate is about to expire, are you sure you want to continue?" warning. That would maintain the security guarantees around expiration while still getting the attention of users/administrators.
Alarm all the users to notify one person? Doesn't seem so good to me.
Isn’t that what happens now when the cert expires? Except when it’s expired it’s a lot harder for users to figure out how to bypass the warnings so they can visit the site to find a contact link to report the issue.
Remember not every site is actively checked by their maintainer every day.
In an ideal world it shouldn’t be needed (and likewise UX for expired certs wouldn’t be needed), but in practice I think it has merit.
Re: What's the right UX for an expired certificate?
#7Browsers could add the less severe warning before the certificate expires, for example 3 days before it expires have a "this certificate is about to expire, are you sure you want to continue?" warning. That would maintain the security guarantees around expiration while still getting the attention of users/administrators.
That's an absolutely terrible idea. Scaring the crap out of thousands of users when your certificates are set to auto-renew etc is just dumb.
Re: What's the right UX for an expired certificate?
#8Just this week I had an issue with a Letsencrypt cert that wasn't updated.
All of my users had visited the site and the certificate was the same. Browsers should give a less dramatic response if they have already seen the certificate and it simply expired. It's completely different from visiting a new site whose certificate the browser has never seen.
Re: What's the right UX for an expired certificate?
#9No completely and super hard disagree. An expired certificate is not a negotiable or "soft" error. What the hell is wrong with people today? It's not rocket science. Get your shit together or fuck off for the sake of everyone else. Nobody cares about all the layers of bureaucracy between you and renewing that cert. That's your fucking problem. Seriously no joke. Stop making this a "mere implementation detail" and you'll be fine. Cryptography is a razor sharp thing. Treat it accordingly.
Re: What's the right UX for an expired certificate?
#10Earlier quoted context omitted.
Alarm all the users to notify one person? Doesn't seem so good to me.
Isn’t that what happens now when the cert expires? Except when it’s expired it’s a lot harder for users to figure out how to bypass the warnings so they can visit the site to find a contact link to report the issue. Remember not every site is actively checked by their maintainer every day. In an ideal world it shouldn’t be needed (and likewise UX for expired certs wouldn’t be needed), but in practice I think it has m…
OP's idea was to scare the users BEFORE it expires (and the admin still has time to renew).
> Remember not every site is actively checked by their maintainer every day.
Precisely… so scaring the users while the owner doesn't get the message is useless.